Supervisor is the management layer in Home Assistant OS. It controls add-ons, services, updates, and other system-level operations, so it sits above normal automations and has much broader privileges than a typical app.
In security terms, Supervisor is a high-value trust boundary. If an attacker can steal a credential such as SUPERVISOR_TOKEN or influence commands sent to Supervisor, they may gain access to privileged APIs and system actions. That is why bugs like argument injection are dangerous in Home Assistant: a small parser flaw in a lower layer can expose Supervisor secrets or lead to host-level control. Defenses include strict argument handling, least privilege, token protection, and separating untrusted input from management commands.